Operating Systems/Linux/Ubuntu/Ubuntu 16.04 LTS/Firewalls

Why?

Firewalls are critical for secure computer usage as prevent unwanted (and potentially malicious) connections from being made.

UFW

What is it?

UFW standing for Uncomplicated FireWall, is the integrated firewall in all versions of Ubuntu 8.04 LTS and later; it has a graphical element (GUFW) that is also available for use. It is a firewall configuration tool running on top of iptables. UFW is a powerful tool that can greatly improve the security of your servers when properly configured.

How to configure

Status

To check if ufw is enabled, run:

sudo ufw status Output: Status: inactive The output will indicate if your firewall is active or not.

Enabling

If you got Status: inactive message when running ufw status, it means the firewall is not yet enabled on the system. You’ll need to run this command to enable it:

sudo ufw enable

Disabling

If you need to disable UFW, you can do so with the following command:

sudo ufw disable

Be aware that this command will fully disable the firewall service on the system.

Blocking an IP

To block all network connections that originate from a specific IP address, run the following command, replacing the IP address with the IP address that you want to block:

sudo ufw deny from 203.0.113.100

Output Rule added

In this example, from 203.0.113.100 specifies a source IP address of “203.0.113.100”.

If you run sudo ufw status now, you’ll see the specified IP address listed as denied:

Output Status: active

To Action From -- ------ ---- Anywhere DENY 203.0.113.100 All connections, coming in or going out, are blocked for the specified IP address.

Blocking a subnet

If you need to block a full subnet, you may use the subnet address as from parameter on the ufw deny command. This would block all IP addresses in the example subnet 203.0.113.0/24:

sudo ufw deny from 203.0.113.0/24

Output: Rule added

Allowing an IP adress

To allow all network connections that originate from a specific IP address, run the following command, replacing the highlighted IP address with the IP address that you want to allow access:

sudo ufw allow from 203.0.113.101

Output

Rule added

If you run sudo ufw status now, you’ll see output similar to this, showing the word ALLOW next to the IP address you just added.

Output Status: active

To Action From -- ------ ---- ... Anywhere ALLOW 203.0.113.101 You can also allow connections from a whole subnet by providing the corresponding subnet mask for a host, such as 203.0.113.0/24.

GUI

Press Alt+F2 and run GUFW, pass the authentication check
Turn the status slider to "on"

CLI

open the terminal
sudo ufw enable
you can use ufw -help to find other commands for further customization